AADSTS501241
What Microsoft says
Mandatory Input '{paramName}' missing from transformation ID '{transformId}'. This error is returned while Microsoft Entra ID is trying to build a SAML response to the application. NameID claim or NameIdentifier is mandatory in SAML response and if Microsoft Entra ID failed to get source attribute for NameID claim, it returns this error. As a resolution, ensure that you add claim rules. To add claim rules, sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator, and then browse to Entra ID > Enterprise apps. Select your application, select Single Sign-On and then in User Attributes & Claims enter the Unique User Identifier (Name ID).
How to fix it
Microsoft doesn't publish a specific fix for this code beyond the description above. This site groups it under saml single sign-on, based on that description, so start with the steps below.
How to investigate
- Capture the SAMLRequest from the browser and decode it with the SAML decoder.
- Compare the Identifier, Reply URL and requested authentication context with the Enterprise App's SAML settings.
- Check the signing certificate is active and matches what the app expects.
- Search the sign-in logs for the request ID or correlation ID from the troubleshooting details on the error page.
Tools that help
The description is quoted from Microsoft's error code reference. The grouping and investigation steps are this site's guidance.